1 What is claimed is: 

2 L In a data processing system including at least one client, a first file server coupled 

3 to the client for data access of the client to at least one file in the first file server, and at 

4 least a second file server coupled to the first file server for data access of the second file 

5 server to the file in the first file server, the second file server being programmed with a 

6 virus checker program, the virus checker program being executable by the second file 

7 server to perform an anti-virus scan upon file data in random access memory of the 

8 second file server, a method comprising: 

9 the first file server responding to a request from the client for access to the file in 

10 the first file server by determining that an anti-virus scan of the file should be performed, 
n and initiating the anti- virus scan of the file by sending to the second file server a request 

12 for the anti-virus scan including a specification of the file, and then 

13 the second file server responding to the request for the anti-virus scan by invoking 

14 the virus checker program to perform an anti-virus scan of the specified file by obtaining 

15 file data of the file from the first file server and storing the file data of the file into the 

16 random access memory of the second file server and performing the anti-virus scan upon 
n the file data of the file in the random access memory. 

18 

19 2. The method as claimed in claim 1, wherein the first file server determines that the 

20 anti-virus scan of the file should be performed when the client requests the first file 

21 server to open the file and the first file server finds that the file has not been checked for 

22 viruses. 

23 
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3. The method as claimed in claim 1, wherein the first file server determines that the 
anti-virus scan of the file should be performed when the client requests a file to be closed 
after the client writes to the file. 

4. The method as claimed in claim 1 , wherein the first file server applies a filter to a 
file extension of the file to determine that the anti-virus scan of the file should be 
performed. 

5. The method as claimed in claim 1, wherein the first file server blocks clients from 
accessing the file from the time that the first file server determines that the anti-virus scan 
of the file should be performed until the anti-virus scan is completed and fails to find a 
virus in the file. 

6. The method as claimed in claim 1, wherein the first file server determines that an 
additional anti-virus scan of the file should not be performed in response to the access of 
the file by the virus checker program. 

7. The method as claimed in claim 1, wherein the first file server maintains in 
nonvolatile memory an indication of files that have not been checked for viruses, an 
indication of files that are in the process of being checked, and an indication of files that 
have been found to contain viruses. 
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8. The method as claimed in claim 1, wherein the request for the anti-virus scan 
including a specification of the file is an Open Network Computing Remote Procedure 
Call. 



9. The method as claimed in claim 1, wherein the second file server receives the 
request for the anti-virus scan and indirectly invokes the virus checker program by 
reporting a file access event to an operating system of the second file server, and the 
operating system of the file server responds by invoking the virus checker program to 
perform the anti-virus scan of the file. 

10. The method as claimed in claim 1, wherein the operating system of the second file 
server supports processes executing in a user mode and processes executing in a kernel 
mode, and a server for virus checking executing in the user mode receives the request for 
the anti-virus scan from the first file server and forwards the request to a virus checker 
initiator driver executing in the kernel mode, and the virus checker initiator driver 
executing in the kernel mode initiates a file access event, and the virus checker program 
initiates the anti-virus scan of the file in response to the virus checker initiator driver 
initiating the file access event. 

1 1 . The method as claimed in claim 10, wherein an input/output manager in the 
operating system of the second file server receives a file access call from the virus 
checker initiator driver, and responds by directing a report of the file access event to the 
virus checker program. 
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12. The method as claimed in claim 1, wherein the data processing system includes at 
least a third file server coupled to the first file server for data access of the third file 
server to the file in the first file server, the third file server also being programmed with a 
virus checker program that is executable by the third file server to perform an anti-virus 
scan upon file data in random access memory of the third file server, wherein the first file 
server performs a load balancing procedure to select one of at least the second file server 
or the third file server to perform an anti- virus scan of the file when the first file server 
determines that an anti-virus scan of the file should be performed, 

13. A method of operating a network file server to initiate a virus scan upon a file 
stored in the network file server, the network file server being coupled to at least one 
client for access of the client to at least one file in the network file server, the network file 
server being coupled to a plurality of secondary servers for access of the secondary 
servers to the file stored in the network file server, the network file server including a 
cached disk array and a plurality of data mover computers coupled to the data network 
and coupled to the cached disk array for responding to client requests for data access to 
storage in the cached disk array, each secondary server being programmed with a virus 
checker program executable for performing an anti -virus scan upon file data in random 
access memory of said each secondary server, a method comprising: 

at least one of the data movers in the network file server responding to a request 
from the client for access to the file in the network file server by applying a filter upon a 
file extension of the file upon opening or closing of the file to determine that an anti-virus 
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scan of the file should be performed, and initiating the anti-virus scan of the file by 
applying a load balancing procedure for selecting one of the secondary servers for 
performing the anti-virus scan of the file, and sending to the selected secondary server a 
request for the anti-virus scan including a specification of the file, and then 

the selected secondary server responding to the request for the anti-virus scan by 
invoking the virus checker program in the selected secondary server to perform an anti- 
virus scan of the specified file by obtaining file data of the file from the network file 
server and storing the file data of the file into the random access memory of the selected 
secondary server and performing the anti-virus scan upon the file data of the file in the 
random access memory of the selected secondary server. 

14. The method as claimed in claim 13, wherein the file is an executable file, and the 
network file server determines that the anti-virus scan of the file should be performed 
when the client requests the network file server to open the file and the network file 
server finds that the file has not been checked for viruses, and the network file server also 
determines that the anti-virus scan of the file should be performed when the client 
requests the file to be closed after the client writes to the file. 

15. The method as claimed in claim 13, wherein the selected secondary server 
receives the request for the anti-virus scan and indirectly invokes the virus checker 
program by causing an operating system of the selected secondary server to invoke the 
virus checker program in the selected secondary server to perform the anti-virus scan of 
the file. 
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16. In a data network including a first server and a second server, the second server 
being coupled by a data network to the first server for access of the second server to at 
least one file stored in the first server, wherein the second server is programmed with an 
operating system supporting processes executing in a user mode and processes executing 
in a kernel mode, the operating system of the second server including an input/output 
manager executing in the kernel mode, a method of operating the second server to 
perform an anti-virus scan upon the file in the first server, said method comprising: 

a server for virus checking executing in the second server in the user mode 
receives from the network a request for the anti-virus scan upon the file, and then 

the server for virus checking forwards the request to a virus checker initiator 
driver executing in the second server in the kernel mode, and the virus checker initiator 
driver responds to receipt of the request by sending a file access call to the input/output 
manager, and then 

the input/output manager responds to the file access call by directing a report of a 
file access event to a virus checker program executing in the second server in the user 
mode, and the virus checker program responds by obtaining file data from the file in the 
first server and storing the file data in random access memory in the second server, and 
performing an anti-virus scan upon the file data in the random access memory in the 
second server. 

17. In a data processing system including at least one client, at least one network file 
server coupled to the client by a data network for access of the client to at least one file in 
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the network file server, and a plurality of NT file servers coupled to the network file 
server by the data network for data access of the NT file servers to the file in the network 
file server, the network file server including a cached disk array and a plurality of data 
mover computers coupled to the data network and coupled to the cached disk array for 
responding to client requests for data access to storage in the cached disk array, each of 
the NT file servers being programmed with a virus checker program, the virus checker 
program in each NT file server being executable by said each NT file server to perform 
an anti-virus scan upon file data in random access memory of said each NT file server, a 
method comprising: 

a data mover in the network file server responding to a request from the client for 
access to the file in the network file server by applying a filter upon a file extension of the 
file upon opening or closing of the file to determine that an anti-virus scan of the file 
should be performed, and initiating the anti-virus scan of the file by selecting a next one 
of the NT file servers in round-robin fashion and sending to the selected NT file server a 
request for the anti-virus scan including a specification of the file, and then 

the selected NT file server responding to the request for the anti-virus scan by 
invoking the virus checker program in the selected NT file server to perform an anti-virus 
scan of the specified file by obtaining file data of the file from the network file server and 
storing the file data of the file in the random access memory of the selected NT file server 
and performing the anti-virus scan upon the file data of the file in the random access 
memory of the selected NT file server. 
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18. The method as claimed in claim 17, wherein the file is an executable file and the 
network file server determines that the anti-virus scan of the file should be performed 
when the client requests the network file server to open the file and the network file 
server finds that the file has not been checked for viruses, and the network file server also 
determines that the anti-virus scan of the file should be performed when the client 
requests the file to be closed after the client writes to the file. 

19. The method as claimed in claim 17, wherein the operating system of the selected 
NT file server supports processes executing in a user mode and processes executing in a 
kernel mode, a server for virus checking executing in the user mode receives the request 
for the anti-virus scan from the network file server and forwards the request to a virus 
checker initiator driver executing in the kernel mode, the virus checker initiator driver 
executing in the kernel mode sends a file access call to an input/output manager in the 
operating system of the selected NT file server, the input/output manager responds to the 
file access call by directing a report of a file access event to the virus checker program in 
the selected NT file server, and the virus checker program in the selected NT file server 
initiates the anti-virus scan of the file in response to receiving the report of the file access 
event from the input/output manager. 

20. A data processing system comprising: 
at least one client; 

a first file server coupled to the client for access of the client to at least one file in 
the first file server; and 
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at least a second file server coupled to the first file server for data access of the 
second file server to the file in the first file server, the second file server being 
programmed with a virus checker program, the virus checker program being executable 
by the second file server to perform an anti-virus scan upon file data in random access 
memory of the second file server; 

wherein the first file server is programmed to respond to a request from the client 
for access to the file in the first file server by determining that an anti-virus scan of the 
file should be performed, and initiating the anti-virus scan of the file by sending to the 
second file server a request for the anti-virus scan including a specification of the file; 
and 

the second file server is programmed to respond to the request for the anti-virus 
scan by invoking the virus checker program to perform an anti-virus scan of the specified 
file by obtaining file data of the file from the first file server and storing the file data of 
the file in the random access memory of the second file server and performing the anti- 
virus scan upon the file data in the random access memory. 

21. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to determine that the anti-virus scan of the file should be performed when 
the client requests the first file server to open the file and the first file server finds that the 
file has not been checked for viruses. 
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22. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to determine that the anti-virus scan of the file should be performed when 
the client requests a file to be closed after the client writes to the file. 

23. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to apply a filter to a file extension of the file to determine that the anti-virus 
scan of the file should be performed. 

24. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to block clients from accessing the file from the time that the first file server 
determines that the anti-virus scan of the file should be performed until the anti-virus 
scan is completed and fails to find a virus in the file. 

25. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to determine that an additional anti-virus scan of the file should not be 
performed in response to the access of the file by the virus checker program. 

26. The data processing system as claimed in claim 20, wherein the first file server is 
programmed to maintain in nonvolatile memory an indication of files that have not been 
checked for viruses, an indication of files that are in the process of being checked, and an 
indication of files that have been found to contain viruses. 
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27. The data processing system as claimed in claim 20, wherein the request for the 
anti-virus scan including a specification of the file is an Open Network Computing 
Remote Procedure Call. 

28. The data processing system as claimed in claim 20, wherein the second file server 
is programmed to receive the request for the anti-virus scan and indirectly invoke the 
virus checker program by causing an operating system of the second file server to invoke 
virus checker program to perform the anti-virus scan of the file. 

29. The data processing system as claimed in claim 20, wherein the operating system 
of the second file server supports processes executing in a user mode and processes 
executing in a kernel mode, and the second file server includes a server for virus 
checking that is executable in the user mode and a virus checker initiator driver that is 
executable in the kernel mode, the server for virus checking being executable for 
receiving the request for the anti-virus scan from the first file server and forwarding the 
request to the virus checker initiator driver, and the virus checker initiator driver is 
executable for causing the operating system reporting a file access event to the virus 
checker program, and the virus checker program is executable for initiating the anti-virus 
scan of the file in response to the report of the file access event. 

30. The data processing system as claimed in claim 29, wherein the operating system 
of the second file server includes an input/output manager that is executable in the kernel 
mode for receiving a file access call from the virus checker initiator driver, and 
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responding to the file access call by directing the report of the file access event to the 
virus checker program. 

31. The data processing system as claimed in claim 20, which further includes at least 
a third file server coupled to the first file server for data access of the third file server to 
the file in the first file server, the third file server also being programmed with a virus 
checker program that is executable by the third file server to perform an anti-virus scan 
upon file data in random access memory of the third file server, and wherein the first file 
server is programmed for performing a load balancing procedure to select one of at least 
the second file server or the third file server to perform an anti-virus scan of the file when 
the first file server determines that an anti-virus scan of the file should be performed. 

32. A network file server adapted for coupling to at least one client for access of the 
client to at least one file in the network file server, the network file server also being 
adapted for coupling to a plurality of secondary servers for access of the secondary 
servers to the file stored in the network file server, each secondary server being 
programmed with a virus checker program executable for transferring file data from the 
file in the network file server to random access memory in said each secondary server, 
and performing an anti-virus scan upon the file data in the random access memory of said 
each secondary server, the network file server comprising: 

a cached disk array; and 

a plurality of data mover computers coupled to the data network and coupled to 
the cached disk array for responding to client requests for data access to storage in the 
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cached disk array, wherein at least one of the data movers is programmed to respond to a 
request from the client for access to the file in the network file server by applying a filter 
upon a file extension of the file upon opening or closing of the file to determine that an 
anti-virus scan of the file should be performed, and initiating the anti-virus scan of the 
file by applying a load balancing procedure for selecting one of the secondary servers for 
performing the anti-virus scan of the file, and sending to the selected secondary server a 
request for the anti-virus scan including a specification of the file. 

33. The data processing system as claimed in claim 32, wherein the file is executable 
and the network file server is programmed to determine that an anti-virus scan of the file 
should be performed when the client requests the network file server to open the file and 
the network file server finds that the file has not been checked for viruses, and the 
network file server is also programmed to determine that the anti-virus scan of the file 
should be performed when the client requests the file to be closed after the client writes to 
the file. 

34. A secondary server adapted for coupling to a primary server in a data network for 
access to data in files in the primary server, wherein the secondary server is programmed 
with an operating system supporting processes executing in a user mode and processes 
executing in a kernel mode, the operating system including an input/output manager 
executable in the kernel mode, wherein the secondary server is further programmed with: 

a server for virus checking executable in the user mode; 
a virus checking driver executable in the kernel mode; and 
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a virus checker program executable in the user mode; 

wherein the server for virus checking is executable for receiving from the network 
a request for an anti-virus scan upon a specified file in the primary server, and for 
forwarding the request to the virus checker initiator driver; 

wherein the virus checker initiator driver is executable for responding to receipt of 
the request from the server for virus checking by sending a file access call upon the 
specified file to the input/output manager; 

wherein the input/output manager is executable for responding to the file access 
call by directing a report of a file access event upon the specified file to the virus checker 
program; and 

wherein the virus checker program is executable for responding to the report of 
the file access event by transferring file data from the specified file in the primary server 
to random access memory in the secondary server, and performing an an ti -virus scan 
upon the file data in the random access memory in the secondary server. 

35. A data processing system comprising: 
at least one client; 

at least one network file server coupled to the client by a data network for access 
of the client to at least one file in the network file server; and 

a plurality of NT file servers coupled to the network file server by the data 
network for data access of the NT file servers to the file in the network file server; 
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wherein the network file server includes a cached disk array and a plurality of 
data mover computers coupled to the data network and coupled to the cached disk array 
for responding to client requests for data access to storage in the cached disk array; 

wherein each of the NT file servers is programmed with a virus checker program, 
the virus checker program being executable by said each NT file server to perform an 
anti-virus scan upon file data in random access memory of said each NT file server; 

wherein at least one data mover in the network file server is programmed for 
responding to a request from the client for access to the file in the network file server by 
applying a filter upon a file extension of the file upon opening or closing of the file to 
determine that an anti-virus scan of the file should be performed, and initiating the anti- 
virus scan of the file by selecting a next one of the NT file servers in round-robin fashion 
and sending to the selected NT file server a request for the anti-virus scan including a 
specification of the file, and 

wherein each NT file server is programmed to respond to the request for the anti- 
virus scan by invoking the virus checker program in said each NT file server to perform 
an anti-virus scan of the specified file by obtaining file data of the specified file from the 
network file server and storing the file data of the specified file in the random access 
memory of said each NT file server and performing the anti-virus scan upon the file data 
of the specified file in the random access memory of said each NT file server. 

36. The data processing system as claimed in claim 35, wherein the file is an 
executable file, and the network file server is programmed for determining that the anti- 
virus scan of the file should be performed when the client requests the network file server 
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to open the file and the network file server finds that the file has not been checked for 
viruses, and the network file server also determines that the anti-virus scan of the file 
should be performed when the client requests the file to be closed after the client writes to 
the file. 

37. The data processing system as claimed in claim 35, wherein the selected NT file 
server is programmed with: 

an operating system supporting processes executing in a user mode and processes 
executing in a kernel mode, the operating system including an input/output manager 
executable in the kernel mode; 

a server for virus checking executable in the user mode; and 

a virus checker initiator driver executable in the kernel mode; 

wherein the server for virus checking is executable for receiving the request for 
the anti-virus scan from the network file server and forwarding the request to the virus 
checker initiator driver; 

wherein the virus checker initiator driver is executable for responding to the 
request from the server for virus checking by sending a file access call to the input/output 
manager; 

wherein the input/output manager is executable for responding to the file access 
call by directing a report of a file access event to the virus checker program in the 
selected NT file server; and 
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wherein the virus checker program in the selected NT file server is executable for 
performing the anti-virus scan of the file in response to receiving the report of the file 
access event from the input/output manager. 

38. A program storage device containing a program executable by a network file 
server, the network file server being adapted for coupling to at least one client for access 
of the client to at least one file in the network file server, the network file server also 
being adapted for coupling to a plurality of secondary servers for access of the secondary 
servers to the file stored in the network file server, each secondary server being 
programmed with a virus checker program executable for transferring file data from the 
file in the network file server to random access memory in said each secondary server, 
and performing an anti-virus scan upon the file data in the random access memory of said 
each secondary server, the program contained in the program storage device being 
executable by the network file server for responding to a request from the client for 
access to the file in the network file server by applying a filter upon a file extension of the 
file upon opening or closing of the file to determine that an anti-virus scan of the file 
should be performed, and initiating the anti-virus scan of the file by applying a load 
balancing procedure for selecting one of the secondary servers for performing the anti- 
virus scan of the file, and sending to the selected secondary server a request for the anti- 
virus scan including a specification of the file. 

39. The program storage device as claimed in claim 38, wherein the file is an 
executable file, and the program contained in the program storage device is also 
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executable by the network file server for determining that an anti-virus scan of the file 
should be performed when the client requests the network file server to open the file and 
the network file server finds that the file has not been checked for viruses, and the 
program contained in the program storage device is also executable by the network file 
server for determining that the anti-virus scan of the file should be performed when the 
client requests the file to be closed after the client writes to the file. 

40. A program storage device containing a program executable by a secondary server, 
the secondary server being adapted for coupling to a primary server in a data network for 
access to data in files in the primary server, wherein the secondary server is 
programmable with an operating system supporting processes executing in a user mode 
and processes executing in a kernel mode, the operating system including an input/output 
manager executable in the kernel mode, and the secondary server is also programmable 
with a virus checker program for performing an anti-virus scan upon file data in response 
to a file opening event being reported to the input/output manager, wherein the program 
contained in the program storage device includes: 

a server for virus checking executable in the user mode; and 

a Virus checking driver executable in the kernel mode; 

wherein the server for virus checking is executable for receiving from the network 
a request for the anti-virus scan upon a specified file in the primary server, and for 
forwarding the request to the virus checker initiator driver; and 

wherein the virus checker initiator driver is executable for responding to receipt of 
the request from the server for virus checking by sending a file access call upon the 
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specified file to the input/output manager, whereby the input/output manager directs a 
report of a file access event upon the specified file to the virus checker program to initiate 
an anti-virus scan upon file data of the specified file. 



H 427020(95H_01'DOC) 



-64- 



